# Changelog

## Score

- CAI 76 → 70 (-6.3)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 98 → 67 (-30.8)
- Architecture 97 → 97 (+0.0)
- Maturity 69 → 65 (-3.9)
- Readiness 77 → 76 (-0.2)
- Security 82 → 82 (+0.3)

## Resolved (4)

- Job-level write token spans steps that do not need it
- Medium CVE: EEF-[CVE redacted] (instrumentation/opentelemetry_bandit/mix.lock)
- Off-boarding risk: anonymized user #1
- Orphaned files with no living knowledge

## New (7)

- Job-level write token spans steps that do not need it (.github/workflows/publish-mix-hex-release.yml)
- Leaked secret: hardcoded-credential (instrumentation/opentelemetry_ecto/docker-compose.yml)
- Off-boarding risk: anonymized user #1
- Outdated: esbuild
- Outdated: phoenix
- Outdated: phoenix
- Outdated: phoenix_live_view

## Changes since last survey

- 19 commits — 16 feature/other, 3 fixes

## By area

- examples/basic_elixir — 4 commits
- examples/roll_dice_elli — 4 commits
- .github/workflows — 3 commits
- instrumentation/opentelemetry_bandit — 3 commits
- docs/README.md — 1 commit
- examples/basic_phoenix_ecto — 1 commit
- instrumentation/opentelemetry_ecto — 1 commit
- instrumentation/opentelemetry_finch — 1 commit
- instrumentation/opentelemetry_xandra — 1 commit

## Notable commits

- fix: fix(deps): update dependency @opentelemetry/exporter-trace-otlp-http to ^0.223.0 (#843)
- fix: fix(deps): update opentelemetry-js-contrib monorepo to ^0.68.0 (#844)
- fix: fix(opentelemetry_bandit): keep tracing when the client disconnects before the request starts (#848)
- change: chore(deps): lock file maintenance (#837)
- change: chore(deps): lock file maintenance (#845)
- change: chore(deps): lock file maintenance (#853)
- change: chore(deps): update dependency bandit to v1.13.1 (#851)
- change: chore(deps): update dependency decimal to v3.2.0 (#840)
- change: chore(deps): update dependency finch to v0.24.0 (#836)
- change: chore(deps): update github-actions (#834)
- change: chore(deps): update github-actions (#838)
- change: chore(deps): update github-actions (#849)
- change: chore(deps): update jaegertracing/jaeger docker tag to v2.22.0 (#841)
- change: chore(deps): update mysql:26.7 docker digest to 9d48c42 (#835)
- change: chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.162.0 (#842)
- change: chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.163.1 (#852)
- change: chore(deps): update patch updates (#839)
- change: chore(deps): update patch updates (#850)
- change: docs(hooks): agree on one callback contract across packages (#814)